Exploring the Unknown: Selected Documents in ... - The Black Vault

Exploring the Unknown 185
In a similar way, the astronaut can be recovered from the capsule in a
variety of ways in the event of a prelaunch emergency. Depending on the time,
he can use the escape mechanism, the gantry can be moved into place, or rescue
may be attempted with the remote controlled “cherry picker” egress tower or the
armored rescue vehicle.
It must be emphasized that these alternate modes of operation for the
main events in the flight are only illustrative of the many redundancies which
are built into all of the systems, subsystems, and components. Of course, the
redundant design philosophy has not proved to be easy. When a backup system is
introduced, extra care must be exercised to insure that there is not some subtle
common link in the two which can fail and thereby inactivate both the main and
emergency system or that the emergency system is not inadvertently used at the
wrong time.
In summary, the Mercury system is heavily dependent on the use of
redundant systems and upon the reliability and decision-making ability of the
astronaut to achieve the desired degree of over-all systems reliability. As far as
the panel could learn, the Space Task Group has given ample attention to the
interrelationships between the redundant systems and of the relationship of the
astronaut to the system.
4. Fire Hazard
The atmosphere in both the capsule and suit is pure oxygen. Consequently
the possibility of fire, with electrical switches or pyrotechnic devices as a source
of ignition, has to receive careful attention. A number of precautions have been
taken to minimize the risk of fire. These include: (a) All electrical switches are
potted or hermatically [sic] sealed; (b) all squibs and shaped charges used in the
vehicle have been installed to vent outward; (c) all combustible materials have
been eliminated wherever this has been possible. Where this was not possible,
materials have been chosen which are incapable of ignition from the hot surfaces
of the capsule. It is important to observe, however, that the astronaut’s suit is made
of the combustible material; (d) the capsule can be depressurized to extinguish a
fire if one should start. Despite these precautions, a certain hazard of fire remains.
Particular attention is required to the period before launch when capsule and the
astronaut’s suit are being purged with pure oxygen at atmospheric pressure.
In particular, it was felt by the panel that an experiment should be
performed in which the emergency hatch was blown off by its explosive bolts with
an internal capsule atmosphere of oxygen. [11]
5. Possibility of Failure with no Redundant Backup
In a system which is heavily dependent upon redundancies to obtain
acceptable reliability, it is necessary to single out the situations or devices for which
there is no backup and in which a single failure would inevitably result in failure
of the mission. Experience has shown that in all major systems, there are some
operations for which it becomes virtually impossible to provide a backup. During
the presentations, no mention was made of the non-redundant operations. A